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(54) Elliptic curve calculation apparatus capable of calculating multiples at high speed 



(57) A fixed-point multiple calculation apparatus, for 
use in an encryption method and a signature method 
that use elliptic curves, finds multiples of a fixed point 
and an arbitrary point at high speed. The fixed-point mul- 
tiple calculation apparatus generates a pre-computation 



tables for multiples of digits at one-word intervals and 
for multiples of digits at half-word intervals. Using the 
tables, multiples of points on an elliptic curve are calcu- 
lated using a doubling process, but with a reduced 
number of additions. This reduces the overall amount of 
required calculation. 
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Description 

BACKGROUND OF THE INVENTION 

(1) Field of the Invention 

The present invention relates to an encryption technique for maintaining the security of information, and in particular 
relates to a multiplication apparatus that performs the necessary calculation for encryption and digital signature tech- 
niques which use an elliptic curve. 

(2) Prior Art 

Secret communication techniques allow communication to be performed without the content being revealed to 
third parties. Digital signature techniques, meanwhile, enable a receiver to verify the validity of the communicated 
content by confirming that the information is from the stated sender. Such signature techniques use an encryption 
technique called public key encryption. 

Public key encryption provides a convenient method for managing the separate encryption keys of many users, 
and so has become a fundamental technique for performing communication with a large number of users. In brief,' 
public key techniques use different keys for encryption and decryption, with the decryption key being kept secret and 
the encryption key being made public. Here, one of the founding principles for the security of public key encryption is 
the so-called 'discrete logarithmic problem". Representative examples of thediscrete logarithmic problem are problems 
defined over finite fields and problems based on elliptic curves. Such problems are described in detail in Neal Koblitz 
A Course in Number Theory and Cryptography (Spin ger-Verlag, 1987). A discrete logarithmic problem based on an 
elliptic curve is explained below. 

The elliptic curve logarithmic problem is as follows. (E(GF(p)) is the elliptic curve £ defined in the finite field GF 
(p), with the element G, given by dividing the order of B by a large prime number, being set as a base point. This being 
so, the problem is to find an integer x that satisfies the relationship 

y=xg 

where the element Y is also given by the elliptic curve E and such value x actually exists. 
■ The reason a discrete logarithmic problem assists in the security of public key encryption is that the above calcu- 
lation is extremely difficult for a large finite field GF(p), with such calculation corresponding to the calculation of the 
inverse, or 'hard direction*, of a one-way function. 

The following is a description of the EIGamal signature technique which uses a discrete logarithmic problem based 
on an elliptic curve. 

Fig. 13 shows a conventional configuration for the EIGamal signature algorithm based on an elliptic curve This 
procedure is described in detail below. 

(1) Settings by the Center 

First, a prime number is set as p, an elliptic curve on the finite field GF(p) is set as £, and an element with the 
order q of E(GF(p)) is set as G. The public key of user A is set as Y a =x a G, while the secret key of user A is set as x 
The center announces the prime number p, the elliptic curve 5 and the base point G as system parameters, and A 
informs other users of his public key Y a . 

(2) Signature Generation 

1. Random number k generated. 

2. R^kG^ry) and s=m+r/x/k (mod q) calculated. 

3. (R 1t s) transmitted together with message m as signature. 

(3) Signature Verification 

Check to see whether sfl 7 =mG+^V a is satisfied. 

As can be seen from the above example, a signature technique based on an elliptic curve requires the calculation 
of the total of kGthat is a "multiple' of the fixed point G and r x Y e which is a multiple of the arbitrary point P (which in 
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thB above conventional example corresponds to the public key Y a ). Two conventional methods lor performing these 
calculations are described below. 

The first method calculates a multiple of the fixed point G, and is described in detail in E.F.Brickell, D.M. Gordon, 
K.S.McCurley and D.B.Wilson, Fast Exponentiation with Precomputation (Advances in Cryptology-Proceedings of Eu- 
s rocrypt'92, Lecture Notes in Computer Science, 1993, Springer-Verlag, pages 200-207). 

First Conventional Method 

The following is a simplified explanation of this first conventional method. 
10 A 160-bit prime number is set as p, an elliptic curve on the finite field GF(p) is set as £ G and kG, which are 

elements of E(GF(p)), are calculated. 

Step 1 - Generatbn of Pre-Computation Table 

is A provisional calculation table is generated by calculating Gj=(1&)G (where i=1, ... ,40) 

Step 2 - Calculation of KG 

A 1 60-bit positive inteqer k is expressed as 

20 

k = k 0 + k 1 *16 + k 2 *1^ + ... + k^K 40 

■ (where -7 ^^....Kio ^8) 
25 kG is calculated by the following routine. 

(Step 2-1) 

B=A=lsign(kj)Gj (total for / where kp&) 
(Step 2-2) 

30 

d-7 

(Step 2-3) 

35 The following processing is performed while cfe 1. 

A = A + IsignfkJGj (total for / where kf=£a) 
B - Eh- A 
d = d-1 

40 Return to Step 2-3 

In this case kG is found as B=kG. 

In the above method, a calculation which doubles a provisional total is not necessary, so that the procedure can 
be achieved through addition alone, although this means that 44 calculations are required. Since there are cases where 
45 these additions are more time-consuming that when doubling is performed, the above procedure is not especially 
efficient. 

A method for calculating exponential powers of an arbitrary point Y g on an elliptic curve is described in Koyama, 
Tsuruoka, Speeding up Elliptic Cryptosystems by Using a Signed Binary Window Method, Advances in Cryptology- 
Proceedings of Crypto'92, Lecture Notes in Computer Science, 1993, Springer-Verlag, pages 345-357. This is ex- 
so plained in detail below. 

Second Conventional Mothod 

The following is a simplified explanation of this second conventional method. 
ss A 160-bit prime number is set as p, an elliptic curve on the finite field GF(p) is set as E, and the elements P and 

kPol the curve E(GF(p)) are calculated. 

This prime number p is expressed in binary as 
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is 



k=k 0 ^2 + k 2 ^ + ... +k 1S9 *2 1S9 =[k 1S9 ^ ViV 

(where ko.... t k 1S9 = 0,1) 
(Step 1) 

This binary number is transformed into an addition-subtraction expression. 
A bit sequence B which forms part of k is found from the lower-order k ( bit 

B=[1,..,b j> ..,1] 

When #S r #S 0 S3, the bit sequence is transformed into T(B) as shown below. 

T(B)=[1,0..J i ...,'1l tf=b r 1 

Here, #B, and #B 0 respectively express the number of ■ /' values and 'Or values included in the partial bit sequence 
B. After transformation, k becomes T. 

(Step 2 - Division into Windows) 

Thovalue Tis expressed as T=ff 7W ,...,fef,,Wand the value T is scanned starting from the MSB (Most Significant 

The bits are analyzed in order towards the LSB (Least Significant Bit) starting from the first bit with the value - 1' 
with the bit sequence being divided just before the first bit with the value V to appear within the following four bits If 
no CT value appears in the following four bits, these four bits are set as a window. 

(Step 3 - Pre-Computation Table Generated) 

Values of sP where (s=3,5,... 15) are calculated and are set as the pre-computation table. 
(Step 4- fcP Calculated) 

T is analyzed starting from the MSB, and a value in the pre-computation table is added for each window in turn 
Atter each addition, the result is multiplied by a power of two. 

In this conventional example, however, there are many windows, meaning that a large number of additions need 
I Hxed po°n7va?ue ^ ** * ° alCU,a,ion is as inefficient as the P revi °"s method of finding a multiple of 

SUMMARY OF THE INVENTION 

It is a primary object of the present invention to provide a calculation apparatus that can efficiently calculate a 
multiple of a fixed point and a muftiple of an arbitrary point which are required by encryption methods and signature 
methods that use elliptic curves. 

This primary object can be achieved by an elliptic curve calculation apparatus for calculating a multiple kG p and 
q being pnme numbers, E(GF(p)) being an elliptic curve over a finite field GF(p), G being a base point which is an 
element with an order q in E(GF(p)) t p being f words long, and k being a positive integer whose number of digits is no 
less than n words (where n>1), the elliptic curve calculation apparatus including: a first table for storing multiples of 
the base point Gand figures produced by combining digits located at one-word intervals in a binary number with the 
same number of digits as A; a second table for storing multiples of the base point G and figures produced by combining 
digits located at one-word intervals in the binary number, the second table storing multiples of different combinations 
of digits in the binary number to the first table; and a calculation unit for calculating the multiple kG of the base point 
by re P eatin 9 a Process where multiples stored in the first table and the second table are added and multiplied by two 

Here, the multiples stored in the first table may be for digits in the integer ftthat are located 1/2 word from the digits 
in the integer k whose multiples are stored in the second table. 

Here, the calculation unit may include a first address generating unit and a second address generating unit, the 
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first and second address generating units receiving a new positive integer k from the calculation unit, referring to a 
sequence of digits in the integer k and generating an address for referring to the first table and the second table, 
• respectively. 

Here, the first and second address generating units may detect digits located at word intervals in the integer /rand 
5 generate addresses from the delected digits, the first address generating unit detecting digits in the integer k that are 
located 1/2 word from the digits detected by the second address generating unit. 

Here, the first address generating unit may detect a first combination of digits at word intervals which includes a 
most significant bit of integer k, the first address generating unit thereafter detecting a combination of digits which are 
shifted by one each time and finally detecting a combination of digits which are located just before halfway points of 
10 the word unit. 

Here, the calculation unit may also include a reading unit, the reading unit using the addresses generated by the 
first address generating unit and the second address generating unit to refer to the first table and the second table, 
and reading values stored at the generated addresses, and the calculation unit may repeatedly perform: a first calcu- 
lation that finds a total of a stored value in the first table and a stored value in the second table that have been read 

is by the reading unit; a second calculation that doubles a calculation result of the first calculation; and a third calculation 
that adds a calculation result of the second calculation to a calculation result of the first calculation for stored values 
that have been newly read by the reading unit from the first table and the second table, where the values in the first 
and second tables, the positive integer k, and the base point G are all expressed in binary. 

The stated object can also be achieved by a communication terminal that performs public key encryption with 

20 another communication terminal, the communication terminal being connected to a center via a network and including 
a random number generation unit for generating a random number k and an elliptic curve calculation apparatus for 
calculating a multiple kG of an element G, where a prime number p, an elliptic curve E(GF(p) over a finite field GF(p), 
the element G with order q of E(GF(p)), and a public key Y a are revealed by the center as system parameters, the 
elliptic curve calculation apparatus including: a first table for storing multiples of the base point G and figures produced 

25 by combining digits located at ono-word intorvals in a binary number with tho same numbor of digits as k, a second 
table for storing multiples of the base point G and figures produced by combining digits located at one-word intervals 
in the binary number, the second table storing multiples of different combinations of digits in the binary number to the 
first table; and a calculation unit for calculating the multiple kG of the base point G by repeating a process where 
multiples stored in the first table and the second table are added and multiplied by two. 

30 The stated object can also be achieved by an elliptic curve calculation apparatus for calculating a multiple kG, p 

and q being prime numbers, E(GF(p)) being an elliptic curve in a finite field GF(p), G being a base point which is an 
element in an order q of E(GF(p)), p being r words long, and k being a positive integer whose number of digits is no 
less than n words (where n>f), the elliptic curve calculation apparatus including: a table for storing multiples of the 
base point G and figures produced by combining digits located at word intervals in a binary number with the same 

35 number of digits as the integer k, a referencing unit for referring to the integer /rand generating an address for indexing 
the table; a first calculation unit for reading a first value from the table using the generated address and for multiplying 
the read first value by a power of two, wherein the power of two equates to a number of digits in half a word; a second 
calculation unit for finding a sum of a second value that is a calculation result of the first calculation unit and a third 
value read from the table using an address newly generated by the referencing unit; a third calculation unit for multiplying 

40 a calculation result of the second calculation unit by a power of two, the power of two depending on a digit position 
within the integer k; and a control unit for having the first to third calculation units repeatedly perform calculation until 
every digit in the integer fchas been used in calculation, where the integer frand the element G are both binary numbers. 

The stated object can also be achieved by an elliptic curve calculation apparatus for calculating a multiple kP of 
an arbitrary point Pon an elliptic curve E, p and q being prime numbers, E(GF(p)) being an elliptic curve in a finite field 

45 GF(p), G being a base point which is an element in an order q of E(GF(p)), p being n bits long, and k being a positive 
prime number whose number of digits is large, the elliptic curve calculation apparatus calculating the multiple kPot 
the arbitrary point Fusing a combination of an addition-subtraction transformation method and a window method, and 
the elliptic curve calculation apparatus including: a coefficient detecting unit for analyzing, when the positive integer k 
is expressed in binary as k=k 0 +k 1 *2+k 2 ~2?+ ... +k n . 1 Z*- 1 (where k 0 ... k n .f = 0or 1), every bit in the positive integer k 

so starting from a least significant bit and extracting each bit where kj=1; a coefficient transforming unit for analyzing, 
when a bit where kj=1 has been extracted and a coefficient fy /+m ^ for an (i+m) bit has a value " 7", higher coefficients 
starting from an (i+m+1) bit and, on finding a bit s where k s -0, generating transformed values t a =1, t 8 ,f-0, ... tf l+m+1) =0 
whero coefficients k (i+m+1) to kg arc inverted; a surplus adjustment unit for adjusting, when the coefficients between 
the s bit and the w-m+f bit have been transformed by the coefficient transformation unit, a surplus added when the 

55 coefficients between the s bit and the /+m+7 bit were transformed, thereby converting kj to k( km+1> into transformed 
values f,*to t( i+m j, value maintaining unit for setting, when a bit where k-=1 has been extracted and k (}+m) has a value 
m CT, frp-Zr^as transformed values t^t 1+m without amendment; and repetition indicating unit for having the coefficient 
detecting unit perform a detecting operation (1) for higher bits starting from an s+1 bit when the surplus adjustment 
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unit has adjusted a surplus and (2) for higher bits starting from an hm+1 bit when the value maintaining unit has set 
k ~ k i+mas trti+av before m either case activating every unit in the elliptic curve calculation apparatus. 

Here, m may be equal to a number of bits in one window used in the window method. 

Here, m may be '4*. 

The stated object can also be achieved by an elliptic curve calculation apparatus for calculating a multiple *Pof 
an arbrtrary point Pon an elliptic curve E , p and q being prime numbers, E(GF(p)) being an elliptic curve in a finite field 
GF(p), G being a base point which is an element in an order q of E(GF(p)) f p being n bits long, and k being a positive 
prime number whose number of digits is large, the elliptic curve calculation apparatus including: an addition^ubstriution 
transformation unit for analyzing, when the positive integer k is expressed in binary as k=k 0 +k 1 '2+k : >*2 2 + +k ,?> 1 
(where k 0 = 0 or 1), every bit in the positive integer k starting from a least significant bH and, when a bit where 
*P* has been extracted and a coefficient k fl+ni) for an (i+m) bit (m being a positive integer) has a value 'V, analyzing 
higher coefficients starting from an (i+m+ 1) bit and, on finding a bit s where k^O, generating transformed values 1 , 
ts - 1 ~?' Wv= 0 where coefficients k (i ^ n+1) to ks are inverted, while adjusting a surplus value added when the 
coefficients between the s bit and the hm+1 bit were transformed to produce transformed values Mo t n ^ from k \o 
k (i+mj , a window dividing unit for dividing, after all bits in the positive integer k have been subjected to transformation 
by the addition-substitution transformation unit to produce a transformed numerical string, the transformed numerical 
string into m-brt windows; a provisional calculation table storing multiples of s (where s=3,5, ... (2m-1)) and the arbitrary 
point P; and a multiplying unit for searching the provisional calculation table using a binary number in a window to 
obtain a value sp, for adding the value sp to a provisional total S„ and for multiplying the provisional total S by an 
appropriate power of two before adding a next value sp, wherein the multiple kPoi the arbitrary point P is found as the 
provisional total S a when every window has been processed by the multiplying unit. 

Here, m may be "4". 



BRIEF DESCRIPTION OF THE DRAWINGS 



These and other objects, advantages and features of the invention will become apparent from the following de- 
scription thereof taken in conjunction with the accompanying drawings which illustrate a specific embodiment of the 
invention. In the drawings: 

Fig. 1 shows an example of a communications system to which the present invention is to be applied; 
Fig. 2 is a block diagram showing a communication apparatus for performing the EIGamal signature technique' 
Fig. 3 is a block diagram showing a fixed point multiple calculation apparatus for finding a multiple of a fixed point 
as an example of the present invention; 

Fig. 4 shows a calculation apparatus for finding a multiple of an arbitrary value, as a different example of the present 
invention; 

Fig. 5 shows the detailed composition of the table storage unit shown in Fig. 3; 

Fig. 6 is a flowchart showing the operation of the first calculation unit shown in Fig. 3; 

Figs. 7 and 8 are flowcharts showing the operation of the second calculation unit in Fig. 4; 

Fig. 9 is a representation of an addition-subtraction transformation operation; 

Fig. 10 is a flowchart showing the processing of the window dividing unit shown in Fig. 4; 

Fig. 11 shows a table that is generated by the table generation unit shown in Fig. 4. 

Fig. 12 is a flowchart showing the calculation operation of the second calculation unit in Fig. 4; and 

Fig. 1 3 shows the method used when communicating an EIGamal signature. 

PREFERRED EMBODIMENTS OF THE INVENTION 

Fig. 1 shows a communications system to which the present invention can be applied. Apparatuses A and B which 
are to perform signed communication on a ring network, for example, are connected to a center. 

Fig. 2 is a block diagram showing the configuration of apparatus A for performing EIGamal signed communication 
As shown in Fig. 2, apparatus A is composed of a random number generation unit 1 , a signature generattorVverification 
unit 6 8 tranSm ' SS,0n Unit 3 ' 8 rece P tion unit 4 ' a fixed P° int multiple calculation apparatus 5, and a secret key storage 

The EIGamal signature techniquo is performed as described below, with this procedure also having been mentioned 
in the prior art section. First, the center announces the prime number p, the elliptic curve E, and the base point G as 
the system parameters, while the apparatus A announces its public key Y e . Next, the transmitter A who wishes to 
perform signed communication generates a signature using a random number produced by itself and the system pa- 
rameters obtained from the center. The apparatus A transmits the signature together with a message to the receiver 
The rece,ver B performs a predetermined calculation using the received signature and message to verify that the 
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signature is genuine. If the signature is genuine, the receiver B can then confirm that the received message is really 
from the transmitter A. 

When signed communication is to be performed, the random number generation unit 1 of the apparatus A generates 
the random number k. Any number of digits may be used for this random number k, with, for example, the same number 
s of digits as the system parameter p received from the center being used. This is to say, if the system parameter p is 
160 bits long, the generated random number k will also be 160 bits long. Circuits for qenerating random numbers are 
well known, and so will not be described here. 

The fixed point multiple calculation apparatus 5 uses the random number k generated by the random number 
generation unit 1 and the base point G, included in the system parameters received from the center via the reception 
10 unit 4 to perform the following calculation. 

R=kG= (r x ,r y ) 

is in this equation, G is a fixed point, so that this equation is called a fixed point multiple calculation. The fixed point 

multiple calculation apparatus 5 will be described in more detail later in this specification. 

The signature generation/verification unit 2 generates a signature when the apparatus A is the transmitter in the 
signed communication, and performs signature verification when the apparatus A is the receiver. When generating a 
signature, the signature generation/verification unit 2 uses the calculation result R 1 of the fixed point multiple calculation 

20 apparatus 5, the secret key x e stored by the secret key storage unit 6. the message m, and the prime number order q 
to calculate the following equation. 

s=(m+rjc a yk(mod q) ( 1) 

25 

On the other hand, when verifying a signature, the signature generation/verification unit 2 uses the signature (R p 
s) received from another apparatus via its transmission unit 3, the message m, and the system parameters received 
from the center to check whether the following relationship is satisfied. 

30 sR^mG+r x Y a (2) 

The above calculations performed by the signature generation/verification unit 2 are composed of multiplication/ 
' divisions and additions which may be performed by hardware or software. However, in the above calculations, the 
35 multiplication (r x Y a ) uses a different public key Y B depending on the other device-in-communication, making this cal- 
culation equate to the multiplication of an arbitrary point. This calculation can be performed somewhat more efficiently 
than in the prior art. The detailed configuration of this signature generation/verification unit 2 is shown in Fig. 4, and is 
described in detail later in this specification. 

40 Calculation of a Multiple for a Fixed Point 

Fig. 3 is a block diagram showing the detailed configuration of the fixed point multiple calculation apparatus 5. As 
shown in Fig. 3, the fixed point multiple calculation apparatus 5 is composed of a table storage unit 51 , a table index 
generation unit 52, a reading unit 53, a first calculation unit 54, an output unit 55, and a control unit 56. 
45 The calculation principles of the fixed point multiple calculation apparatus 5 will be explained before the configu- 

ration of the various components of the present apparatus. 

As its name suggests, the fixed point multipfe calculation apparatus 5 finds a multiple *Gof a fixed point G. When 
the random number k is expressed as a 160-digit binary number, /ccan be given by the standard expression below. 

50 k=k 0 *2°+k 1 *2 1 +k 2 *2 2 + ... +k lS9 t 2 159 

(where k 0 , k v k 2 ... k l£9 =0 or 1) (3) 

ss The multiple of a fixed point can bo found as the total of separately multiplying G by the value represented by each 

element in the above equation, although this involves a large amount of calculation and will take a long time. As an 
alternative, if a correspondence table is generated where coefficients *,at 32-bit intervals are associated with a result 
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of finding a multiple of G for a total of a binary number whose digits are at 32-bit intervals, the multiplication result for 
■ a group of coefficients *,at 32-bit intervals can be obtained simply by referring to the correspondence table If this 
process ts repeatedly performed with the combination of coefficients *, being shifted by one each time until there are 
no more coefficients, a total value can be obtained. When doing so with a single correspondence table, the referencing 
and multiplication for the correspondence table needs to be repeated 32 times, although when two correspondence 
tables are used, this may be halved to 1 6 times, making the processing more efficient. This is the fundamental principle 
for the calculation of a multiple of a fixed point in the present embodiment. 

The following is a description of the configuration of each component in the fixed point multiple calculation appa- 
ratus 5, based on these principles. KH 

Configuration of the Table Storage Unit 

Fig. 5 shows the stored content of the table storage unit 51 . In this figure, s is a sequence which shows a combination 
of coeff.c.ents *,at 32-bit intervals. The random number k is composed of 160 bits, so that there are five coefficients 
I?! t ,nt6rValS - AS 3 r6SUf1, S Can be sesn t0 be a 5 " bit sea . ue ™e. It should be noted here that the arrangement 
of the bits tn the sequence s is such that the highest bit in s matches the highest coefficient in the random number. 
Sinco each coefficient * /C an be '0'or ■ 1\ there are a total of 2S( = 32) patterns from '0000CT to - 11 11 r for the sequence 
s. It should be obvious that after generating the random number K each coefficient * f is unequivocally determined and 
since it is necessary to find totals for combinations of coefficients A^at 32-bit intervals regardless of the value generated 
as the random number, this means that a total of 2 S (=32) patterns from '0000CT to ' 1111V need to be prepared for the 
sequence s. For this reason, values from '00000" to '11111' are shown for the sequence s. As should be clear from 
the above explanation, the sequence s can cover all possibilities for the combinations of coefficients fc of the random 
number k, while not being the group of combination of coefficients fcj themselves. This is shown by the following equa- 



s =[^4 a 3 a 2 a i a (J ( wh e™ a 0 to a 4 =0 or 1) 



(4) 



Here, the notation /a^a^a^^ simply represents a sequence of "C*s and " 1"g. 

The notation A(s) represents a value obtained as a multiple of the base point G for a value given by the lowest bit 
Je ^ nd0m number k and the values of 106 n '9 ner bits given in 32-bit intervals (which is to say k 32 *232, k^*** 
k 96& . ki2s2 128 ) When doing so ; A(s) needs to be prepared for all 32 possible patterns of foM-a-aJ. As one 
example, when s is "00001 only the lowest coefficient k 0 of the lowest bit is 1 , so that A(s) is equal to G itself When 
s is -0001 0", only the coefficient k^ which is 32 bits higher than the lowest bit is 1 , meaning that A(s) is equal to 
Similarly, when s is "0001 1 \ Z^and k& are 1, meaning that A(s) is equal to 2^G + G. Equation (5) below is the general 
tormula for calculating A(s). 



ss 



(5) 



On ihe other hand, the notation B(s) represents a value obtained as a multiple of the base point G for a value given 
by the values of the coefficients of the value k given in 32-bit intervals starting from the 16th bft from th LSB (L , 
Significant Bit), which is to say k (16+32) , k (16+e4 ^s^ K k(16+96) * ™s can 

be said to be a value of A(s) for the same sequence s which has been shifted 1 6 bits towards the MSB The reason 
this shift is performed by 16 bits is that the sequence s relates to 32 bit groupings of the coefficients k h and that the 
value 16 is exactry half of 32. As a result, the number of repeated cycles performed for the calculation of the multiple 
flxed P oint can be reduced to 1 6. Equation (6) below is the general formula for calculating B(s). 

so B(s)=a 0 '2 1$ 'G^ l ^^'G^2 (16 ^G 



Table Index Generation Unit 



The table index generation unit 52 temporarily stores the random number k whenever it is generated, and detects 
coefficients in the random number k located at 32-bit intervals. Since the random number k is a 1 60-bit value as shown 
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by Equation (3), there are the following 32 patterns of coefficients taken at 32-bit intervals. 

(0) [ki 29 ,k 9€ ,k S4 ,k 32 ,ko] 

( 1 ) (k 1 2& kg?, k$s, kgz kj 

{2)lk-t30> ^98< ^66' k$4> M 



0) [^2&+i)' k (96+j)'^64+j)> k (32+j)> k il 



(3 1 ) /Kj $9> k i27> k 9S> k 63> k 3lJ 

The table index generation unit 52 generates respective index addresses (the combinations of coefficients given 
above) for indexing each of A(s) and B(s)ior each of the 1 6 repetitions (hereinafter, 'cycles"). The order for this gen- 
eration is decided according to the coefficient / (0</<15) indicated by the control unit 56. In the first cycle, the combi- 
nations (15) and (31) of the coefficients fyare outputted, with these being decreased by one in each cycle until finally 
(0) and (16) are outputted. 

When the index address generated by the table index generation unit 52 for seeking A(s) is set at Uyand the index 
address for seeking B($) is set at Vj, A($) and B(s) can be found according to the following Equations (7) and (8). 

4 

i=0 



4 

i=0 

where i=0, 1,2,3,4 
As a specific example, when j=15, U 1S and V^are as follows. 

xi «v *? 4 +k *7 3 +ic *? 3 +)c * + ic 

=k U3 *2 4 +k ni *2 3 +k 79 *2 2 +k 47 *2+k ls ... (9) 



50 v is~^^*i*i«*:^ *2 +k (32m2 + 1$4>lS) +2 +k (S2 , 2 + lftlS) +2 +k (324l€ , 2S) *2+k (U > 1Sf 

=k l59 * 2 4 +k 127 *2 3 +k 9S *2 2 +k ej *2+k 3i ... (10) 

55 The values given in (9) and (10) respectively correspond to the patterns (15) and (31) of coefficients. When j-0, 

U 0 and V 0 are as follows. 
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These values correspond to the patterns (0) and (16) ot coefficients. While the configuration of the table index 
ZlT^ 1^ n ° l . been il,US,,a,ed ' "* C ° mp0nent ran be <* hardware^ softer tafeTecuK 

!n me art * ^ t,0nS <?) *" <8) SUCh * S °' ,Wa ' e Can be easil * ^figured byTe oS 

Reading Unit 

stora^unH 51 "iTL" ™ ^ V > ^ ,h8 teble indeX 9 enera,ion u "« 52 * ••*«* the table 

storage unit 51 , reads the corresponding values AtyBty from the table and outputs them to the first calculation unit 

First Calculation Unit 

Whenever a new random number is generated, the first calculation unit 54 uses the values A(U) BfVl read out 
TnlT '^^^-"'"P^Gofated point .m*?^*^^*^^!^!^. 

SZT^hTta/ me ": 0d firS ' te eXplained 1,16 multi P' e a «"* P° in ' " ^sically found by mul 

lifting the ^base , point G by each digit in the random number k and then totaling the multiplication results TrTis 
represented by the following Equation (11). 

+* 3 ^-G+V2 ?, 'G + V2-G+VG (11) 
The values A(Uj). B(Vj) read out from the table storage unit 51 are given by the following list of equations. 

^rt/^=*,«^' <3 -G + A„,-2'"'G + /(„-2 79 -G + / (<7 -2 47 -G + /c, 5 -G 



AfU,)^ •2 129 -G + k 97 '^ ? -G + k es -2 6S •G + k 33 -2 33 'G +k ,-G 

W^m^-G+k^'G+k^-G+k^-G+kSG 
B(Vj) 
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B(V 13 )=k 1S7 *2 1S7 *G+k 125 '2 12S ^k 93 *^ 3 *G+k €l *2 61 'G+k^*^ 9 *G 



erV J M r4S *2 T45 *G+/r n5 *2 n3 *G+/f 9 /2 8T *G+/f 49 *2 49 ^G+fr J7 -2 T7 *G 

15 B(Vo)= k i44 *2 144 *G+k 112 '2 1 12 'G+kg^'G+k^ 4 * *G+k 16 *2 16 *G 

To find kG using the above values A(Uj), B(Vj) t the recurrent formula shown below as Equation (12) is used, con- 
sidering the differences in digits between the elements. 

so 

Tn- fA <V U ) Wis) I (V u ) +B(V U ) 
25 T 13 =T t4 *2+A(U 1J )+B(V l3 ) 

T l2 =T l3 *2+A (U U )+B(V U ) 

30 

T 0 =T 1 +2+A(V g )+3(V 0 ) 
35 T 0 =kG (12) 

In the flowchart shown in Fig. 16, step S2 sets Tas the zero point (=~). In step S5, the values A(Uj), B(VJ are 
40 found and read from the table storage unit 51 using the values Uyand Vj received from the table index generation unit 
52. The processing in the loop from step S4 to SB is iterated to execute the recurrent formula shown above. When j is 
judged to be less than m (T in step S4, the value Tat that time will be equal to kG, with this being outputted to the 
signature generation/verification unit 2 via the output unit 55 (step S9). It should be noted that the decrementing of the 
value /in steps S3, S4, and S8 is performed by the control unit 56. 

45 

Calculation of a Multiple of an Arbitrary Point 

The following is an explanation of the calculation of a multiple r x Y a dl an arbitrary point by the signature generation/ 
verification unit 2. As shown by the block diagram in Fig. 4, the signature generation/verification unit 2 is composed of 

so a transformation unit 21 , a window dividing unit 22, a table generating unit 23, a second calculation unit 24, and an 
output unit 25. The value r x represents the x component of the data R, transmitted together with the message mfrom 
the device-in-communication whon performing EIGamal signed communication. This value r x is a random number, and 
since a random number k is multiplied by a public key Y g when performing encrypted communication, this value r x will 
be regarded as the random number k for ease of explanation. Accordingly, the following description focuses on the 

ss multiplication *V a of the random number and the public key by the signature generation/verification unit 2. This random 
number kcan be a 160-digit binary number as shown by Equation (3). 
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Transformation Unit 

The transformation unit 21 performs an "addition-subtraction" transformation for the random number k The details 
of the procedure for an addition-subtraction transformation are shown in the flowcharts in Figs. 7 and 8 but in short 
suchtransforr^ 

into the coefficient series T=ft n+P t„ t^.A^M The method for performing this transformation is shown below. 

(1 ) The random number k is searched starting from the LSB, and a coefficient k F 1. 

"> (2) On finding a bit where k F 1, the coefficient k (U4) located four bits higher than this bit is analyzed and if k n ^<=0 

below ,6ntS k,X ° kfH4)Bfe ^ C0GfficientS * t0 f M without amendment. This is shown by Equation, (13) 

W = *M (13) 
^ The same operation is then repeated starting from the (i+5) bit in the direction of the MSB. 

(3) If, on the other hand, * M =7, the processing of k (}+3) to *, is held over and the hiqher bits are examined starting 
from the (i + 5) bit. The first coefficient that is V is set as bit s, with the value t s =i being set. At the same time all 
coefficients from the (s-1) bit to the (i+4) bit are set at zero, so that 

25 

The complement of 2 of the binary numbers [k (i+3) ,k (i+2)l k (i+v , kj\s then found for coefficients k (i+3} to k, 

30 

™<h*{ 23 + k w{?+ k ^ (H) 

Negative values are found for all these coefficients and the result is set as the / coefficients. 

?s 

I W W; ' *(i+ v. t-H-^ui) '' k (i+2) '> ' k (hi)' mk i (is) 



The processing is then repeated starting from the (s+ 1) bit. By repeating the processing until the MSB is reached 
the transformed coefficient series 7*is obtained. 

The following is description of the transformation process for the specific example shown in Fig 9 In Fiq 9 a 
28-d.grt binary number is shown as the random number k. The transformation is performed on this random number k 
starting from the LSB, and since the value of the LSB is ' 7' in this example, the LSB is set as the coefficient fcand the 
coefficient ^ located 4 bits higher than this brt / is analyzed. In this case, k (M) =0, so that the coefficients to jfc^ 
are set as the coeff.cients f, to t (M) without amendment. This transformation result for this part of the coefficient series 
is shown as 7 ; in Fig. 9. 

Next, the processing advances to the (i+5) bit and ana^zes whether its value is "<r or "7'. In this example the 
value of the (t+5) bit is -7", so that this bit is newly set as the /bit, and the coefficient k (l+4) located four bits higher'that 
this new / brt is analyzed. In this case, k (Mf 1, so that the higher bits are analyzed and the first coefficient with the 
value zero is set as the bit s. In the illustrated example, k^0\or the bit located three bits higher than the (i+4) bit As 
a result, the coefficient for the s bit is set at ■ 7", and the bits (s-1) to (i+4) are set at zero to generate the generated 
coefficients into t s to t (My After this, the processing shown in Equations (13) and (14) is performed for k n ^ to K to 
obtain the result "7707". In this way, the transformation for the s to / bits (the 13* to 6th brts of the random ^ mbe ; k) 
is completed, with the transformation result for this part of the coefficient series being shown as T 2 in Fig 9 

After this, the above processing is repeated for the higher bits to give the coefficient series T 3> with the processing 
continuing until the MSB of the random number k is reached. At this point, the partial coefficient series 7, 7* 7, 
are concatenated to give the final transformed coefficient series 7 "' 

The flowchart in Fig. 7 shows the processing for transforming the coefficient series of the 160-bit random number 
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k. In this flowchart, the variable /given in steps S72 and S76 shows a bit position in the random number The expression 
"7 memory' given in steps S75 and S78 meanwhile refers to a memory used for storing the transformed coefficients 
t } . When it is judged in step S73 that i>159 t the values stored in the" Tmemory will be the transformed coefficient series 
T=[t 16 o> t iS9> ~ t iM As shown in S73-> S74-» S75-> S76-* S73 so long as zero bit values continue from the LSB, 

s zeros will be written into corresponding bit positions in the Tmemory. On the other hand, when a * 7' bit value is detected 
(S74), it is judged in step S77 whether the coefficient located 4 bits higher than this value isalso '1°. If not, the processing 
advances through steps S78 and S79 with the coefficients being stored in the Tmemory without amendment. If the 
judgement "Yes" is given in step S77, the processing proceeds to the subroutine shown in Fig. 8, and the calculations 
shown above as Equations (13) and (14) are performed. In step S84 in Fig. 8, the transformation process is performed 

io for the higher bits from the (i+4) bit to the s bit, while in steps S85 and S86, the transformation is performed for the 
coefficients from the i bit to the (i+3)b\\. The processing in the flowcharts in Figs. 7 and 8 has already been explained, 
and so will not be dealt with further. 

As can be seen from the processing in step S84, the addition-subtraction transformation is such that when many 
digits in the random number are *7", these will be converted to zeros, thereby reducing the number of coefficients with 

is the value V. This is of particular importance in the present invention. 

Window Dividing Unit 

As shown in Fig. 10, the window dividing unit 22 searches the coefficient series T(S102 > S103 -» S104 -»S105 
20 _> S103) obtained by the transformation unit 21 (S101) starting from the MSB, and sets a group of four bits starting 
from the first "7 "value to be detected as one window (S106). This processing is repeated (S107) until the LSB is 
reached. It should be clear here that if a large number of coefficients have the value "0", the number of generated 
windows will be very small. Also, since the number of "7 "coefficients is reduced by the addition-subtraction transfor- 
mation, the present method is able to minimize the number of windows by performing the addition -subtraction trans- 
ss formation bofore tho division into windows. 

An example result of division into windows for the coefficient series T after addition-subtraction transformation is 
shown at the foot of Fig. 9. As can be readily understood, the number of windows has been reduced compared with 
conventional techniques. 

30 Table Generating Unit 

On receiving the public key Y a , the table generating unit 23 calculates odd-number multiples of the public key Y g . 
Since the size of each window is 4 bits (so that the maximum value in base 10 is "75"J, "15" is set at the highest odd 
number multiple. The generated table is shown in Fig. 11. 

35 

Second Calculation Unit 

The second calculation unit 24 searches the transformed coefficient series T starting from the MSB, adds a value 
given by the table for each window, and then multiplies the result by "2". This procedure is shown in detail in Fig. 12. 

40 The first window is set as the processing target in step S1 21 , and the four bits inside the first window are analyzed in 
step S122. In step S123, bits with the value "fare extracted starting from the highest of the four bits. As one example, 
if the value of the four bits is "1100", the value "77" is extracted, while when the value of the four bits is "7070', the 
value "707" is extracted. Here, the extracted bit sequence will definitely be an odd number which in decimal notation 
is ' 75" or less. The generated table is then referenced using the extracted bit sequence and the value sY Q is obtained 

45 (S124). The processing then proceeds to S125. In step SI 21, the value Zis cleared to zero for the first window, so 
that in this first execution of S125 the value sY B is stored into the memory Z Following this, the number of zero coef- 
ficients between the lowest bit in the extracted bit sequence and the highest bit in the second window is detected and 
set as the value m (S1 27). 

The processing target is then set as the second window (S126), and as before coefficients with the value "7 "are 
so detected starting from the highest of the four bits in the window (S124). The processing then proceeds to the calculation 
in step S125. In this case, the calculation result for the first window will have been stored in the Z memory and the 
value m will have been set in the preceding execution of step S127. Accordingly, the stored value of the Z memory is 
updated as shown bo low. 

Z^sYJw^HsYJW;, 

where (sY e )w 1 is the value obtained from the table when processing the first window and (sY g )w 2 is the value 
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obtained from the table when processing the second window. 

The processing in steps S122 to S128 is repeated for the third and fourth windows and once the processing has 

EZET? f L° ! T d0WS ' me pf0CeSSh9 adVar,ces 10 ste P S130 - Here, the number ot 

following the lowest bit ,n the final window WlmlI is detected as the variable n. The value stored in the Z^™v at 

bPinl If h? f h ^nb0dirne '; , re T P ' eSen ' S bUt ° ne example °' th8 presen < invenli ° n wn *h nol be construed as 
bZeT S ^ ™ 9 SeVe " eXamp ' eS °' »« can be made to throve em! 

wor^rZi^t 11 ^' n9 3 mUltiP '! °' 3 POim> A(S) and B(s) s,ored in ,he teble stora 9e unit are totals of one- 
.^2*" ^ efe ° ne ^J 5 at 32 bite ' »» the table index generation unit extracting coefficients from 

1 1 ibi^ o r rSr ^,""2 1 32 bte) 81 3 ,ime H ° W6Ver ' md »«* is not IWed t0 32 and so may be Z 
b J t J rnlf 1 h ° WeVer ' "* Wn * he rand0m number is 160 bi,s to "9. *• "tting of one word at 32 
maples " 9nn9 ,h8 nUmbBr °' bi,S US6d '° r ,he index address and »• valu * °< *• to^s of the 

of ^^S*°? , " nt ."IT CalCUla " 0n °' 3 mU " ip ' 8 °' 3 flXBd point is ,ound usi "9 lwo kinds ' >W ™> W 
Z one wl!d ™ r : h ! ?K° U9h ' hree ° f m ° re k " dS may eqUa '^ be USBd When so, the n mber of Ms 
Tnd Thnl - , rf y ' hB nUmber °' Wn * °' l0,a ' 5 ' 006 °' lhesB ,olals ™V be set a ■ standard total" 
and the remarnmg totals may be set as equating to a part of the multiple at a bit position which is shifted L 
appropriate number of bits from the standard total. 

a Alternatively ; the multiple may be calculated using only one kind of total. A( S >. When doing so, the value W'A 
iS^SLT^ Va ' U0 A(S ' bV 5iX, ° 0n ^ ' he ~" bei "° USed in P ,ace 01 *> * < b ° — n 

4 When dividing into windows as part of the calculation of a multiple of an arbitrary point, each window was set 
as tang tour b»s long, although this window size is of no particular importance, n should be obTous mT 8 *i 
windows or 16-bit windows can equally be used. oovious mat e-bit 

' Fir a h l ab0Ve amb0dim8^, deals wi,h ,he ™ "^re P«sent invention is adapted to an apparatus performing 
to ™,T edcommu "! cat, °"' aNh °^ « ™V equalfy be adapted to encrypted communteata and in paS 
to encrypted communication that uses elliptic curves. 

? T 6 Wa8described as an elemen ' h <he order q of the elliptic curve E(GF(p)) in the embodiment 
although it is also possrble to use an element in an order of an elliptic curve E(GF(ff)) in an extended field Teino 

t^deS^ 

the extended field may be used in place of the normal elliptic curve E(GF(p)). 

u a ^ U =!i n h 9 8 T m * t a " arbi,raV Pt "' n '' 8 combinali °" 01 add «i°n and multiplication using a power of 

2 were used although a combination of addition, multiplication by v. and multiplication by '4- may be used 
when doing so, multiplication by can be achieved by a polynomial using projective coordinates. 

dra^T S foL P rlZ?r !k>n ""J b88n ,U " y d8SCribBd by Way °' exam P' es wfth "i™™ <° accompanying 
U nZ?« h h ar '° US Chan9eS and modi,ica ! ion s will be apparent to those skilled in the art Therefore 

blTinclude^ m0dmCa,l ° nS dePart "° m SC0P8 °' ^ ^ ,hey 8hould be ~ d - 



Claims 

1 . An elliptic curve calculation apparatus for calculating a multiplo kG, 

p and q being prime numbers, 

E(GF(P)) being an elliptic curve over a finite field GF(p), 

G being a base point which is an element with an order'q in E(GF(p)) 

p being / words long, and 
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k being a positive integer whose number of digits is no less than n words (where r&1), 
the elliptic curve calculation apparatus comprising: 

a first table for storing multiples of the base point G and figures produced by combining digits located at 
one word intervals in a binary number with the same number of digits as k, 

a second table for storing multiples of the base point G and figures produced by combining digits located 
at one word intervals in the binary number, the second table storing multiples of different combinations of 
digits in the binary number to the first table; and 

calculation means for calculating the multiple kGo\ the base point G by repeating a process where mul- 
tiples stored in the first table and the second table are added and multiplied by two. 

The elliptic curve calculation apparatus of Claim 1, 

wherein the multiples stored in the first table are for digits in the integer A: that are located 1/2 word from the 
digits in the integer k whose multiples are stored in the second table. 

The elliptic curve calculation apparatus of Claim 2, 

wherein the calculation means includes a first address generating unit and a second address generating unit, 
the first and second address generating units receiving a new positive integer k from the calculation means, 
referring to a sequence of digits in the integer /rand generating an address for referring to the first table and 
the second table, respectively. 

The elliptic curve calculation apparatus of Claim 3, 

wherein the first and second address gonorating units detect digits located at word intervals in the integer k 
and generate addresses from the detected digits, 

the first address generating unit detecting digits in the integer k that are located 1/2 word from the digits 
detected by the second address generating unit. 

The elliptic curve calculation apparatus of Claim 4, 

wherein the first address generating unit detects a first combination of digits at word intervals which includes 
a most significant bit of integer k, the first address generating unit thereafter detecting a combination of digits which 
are shifted by one each time and finally detecting a combination of digits which are located just before halfway 
points of the word unit. 

The elliptic curve calculation apparatus of Claim 5, 

wherein the calculation means also includes a reading unit, the reading unit using the addresses generated 
by the first address generating unit and the second address generating unit to refer to the first table and the 
second table, and reading values stored at the generated addresses, 
the calculation means repeatedly performing: 

a first calculation that finds a total of a stored value in the first table and a stored value in the second table 
that have been read by the reading unit; 

a second calculation that doubles a calculation result of the first calculation; and 

a third calculation that adds a calculation result of the second calculation to a calculation result of the first 
calculation for stored values that have been newly read by the reading unit from the first table and the second 
table, 

wherein the values in the first and second tables, the positive integer k, and the base point G are all expressed 
in binary. 

A communication terminal that performs public key encryption with another communication terminal, the commu- 
nication terminal being connected to a center via a network and including a random number generation means for 
generating a random number kand an elliptic curve calculation apparatus for calculating a multiple W3of an element 
G, where 



a prime number p, 

an elliptic curve E(GF(p) over a finite field GF(p), 
the element G with order q of E(GF(p)), and 
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a public key Y a 

are revealed by the center as system parameters, 
the elliptic curve calculation apparatus comprising: 

a first table for storing multiples of the base point 6 and figures produced by combining digits located at 
one word intervals in a binary number with the same number of digits as A- 

a second table for storing multiples of the base point Gand figures produced by combining digits located 
digits in the binary number to the first table; and 

calculation means for calculating the multiple KG of the base point G by repeating a process where mul- 
tiples stored in the first table and the second table are added and multiplied by two. 

8. The communication terminal of Claim 7, 

fr Qm £Tn the ™' tip ' eS St0red in 016 first table are for **** * the random number fcthat are located 1/2 word 
from the digits in the random number k whose multiples are stored in the second table. 

9. The communication terminal of Claim 8, 

TrTIZT CUte ! i0 " means includes a « re < ^dress generating unit and a second address generating unit 
the f,rst and second address generating units receiving a new random number k from the calculation means 

a^^r ^ di9i ' S h ' he rand0m " Umber * and 9~"9 « address for referring*,™'" « 

table and the second table, respectively. a 

10. The communication terminal of Claim 9, 

wherein the first and second address generating units detect digits located at word intervals in the random 
number /rand generate addresses from the detected digits 

m^TZ 5 JZT^ Unit d8teCtin9 di9 " S ^ inte " r * th3t are ,OCat6d 1/2 word f ™ the digrts 
detected by the second address- gene rating unit. 

11. The communication terminal of Claim 10, 

wherein the first address generating unit detects a first combination of digits at word intervals which includes 
ioTJK^ nUmb6r K firSt addreSS 9eneratin9 Unit thereafter ^^^^ 

12. The communication terminal of Claim 11, 

toltV^T^™ m8anS alSO indUdeS 3 rMdin9 uni '' ,he readi "9 uni < usi "9 ,h8 addresses generated 

slid »h,f = h "J"" 3 "? Un " and ,hB S8C0nd addreSS 9enera,in 9 unit 10 re,er «^ firs, tabfe and he 
second table, and reading values stored at the generated addresses, 

the calculation means repeatedly performing- 

that't?^" {> TJ'T 3 10,31 °' 3 St0fed V3lUe ln ,h6 ,irSt teble and a slored value second able 
that have been read by the reading means; 

a second calculation that doubles a calculation result of the first calculation- and 

a th.rd calculation that adds a calculation result of the second calculation to a calculation result of the first 
cation for stored vaiues that have been new^ 

the values in the first and second tables, the random number k, and the base point Gare all expressed 

13. An elliptic curve calculation apparatus for calculating a multiple kG, 

p and q being prime numbers, 

E ( GF (p)) being an elliptic curve in a finite field GF(p), 

G being a base point which is an element in an order o of E(GF(p)) 

p being /words long, and 

k being a positive integer whose number of digits is no less than n words (where n>/), 
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the elliptic curve calculation apparatus comprising: 

a table for storing multiples of the base point G and figures produced by combining digits located at word 
intervals in a binary number with the same number of digits as the integer k, 
s referencing means for referring to the integer k and generating an address for indexing the table; 

first calculation means for reading a first value from the table using the generated address and for multi- 
plying the read first value by a power of two, wherein the power of two equates to a number of digits in 
half a word; 

second calculation means for finding a sum of a second value that is a calculation result of the first cal- 
10 culation means and a third value read from the table using an address newly generated by the referencing 

means; 

third calculation means for multiplying a calculation result of the second calculation means by a power of 
two, the power of two depending on a digit position within the integer k; and 

control means for having the first to third calculation means repeatedly perform calculation until every digit 
is in the integer k has been used in calculation, 

wherein the integer /rand the element G are both binary numbers. 

14. An elliptic curve calculation apparatus for calculating a multiple fcPof an arbitrary point Pon an elliptic curve E, 

20 p and q being prime numbers, 

E(GF(p)) being an elliptic curve in a finite field GF(p), 

G being a base point which is an element in an order q of E(GF(p)), 

p being n bits long, and 

k being a positive prime number whose number of digits is large, 
25 the elliptic curve calculation apparatus calculating the multiple kP of the arbitrary point P using a combination 

of an addition-subtraction transformation method and a window method, and 
the elliptic curve calculation apparatus comprising: 

coefficient detecting means for analyzing, when the positive integer k is expressed in binary as 

30 

k=k 0 +k 1 *2+k 2 '2 S +... +k f1m1 2 n ' 1 



ss 



(where k Q ... k^ } =0or1) 

every bit in the positive integer k starting from a least significant bit and extracting each bit where /cpf," 
coefficient transforming means for analyzing, when a bit where kf=1 has been extracted and a coefficient 
k (j+m) tor an (i+m) bit has a value V, higher coefficients starting from an (i+m+1) bit and, on finding a bit 

s where k s =0, generating transformed values t s =1, 1^=0, t(;+m+if0 where coefficients k (j+nHl) to kg 

are inverted; 

surplus adjustment means for adjusting, when the coefficients between the s bit and the i+m+1 bit have 
been transformed by the coefficient transformation means, a surplus added when the coefficients between 
the s bit and the i+m+1 bit were transformed, thereby converting k, to k (U . m+1 ) into transformed values r,- 

value maintaining means for setting, when a bit where k { =l has been extracted and k (Um) has a value "CT, 
k^k j+m as transformed values t~t i+m without amendment; and 

repetition indicating means for having the coefficient detecting means perform a detecting operation (1) 
for higher bits starting from an s+1 bit when the surplus adjustment means has adjusted a surplus and 
(2) for higher bits starting from an i+m+1 bit when the value maintaining means has set /r,~fr /+m as rp-f (+mf 
before in either case activating every means in the elliptic curve calculation apparatus. 

15. The elliptic curve calculation apparatus of Claim 14, where m is equal to a number of bits in one window used in 
the window method. 

16. The elliptic curve calculation apparatus of Claim 15, wherein m is *4". 

17. An elliptic curve calculation apparatus for calculating a multiple kP of an arbitrary point Pon an elliptic curve E, 
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p and q being prime numbers, 

E ( GF (P)) being an elliptic curve in a finite field GF(p), 

G being a base point which is an element in an order q of E(GF(p)), 

p being n bits long, and 

k being a positive prime number whose number of digits is large, 
the elliptic curve calculation apparatus comprising: 

addition-substitution transformation means for analyzing, when the positive integer Zeis expressed in binary 

(where k 0 ... k n ^ =0or1) 

every bit in the positive integer Starting from a least significant bit and, when a bit where k F i has been 
extracted and a coefficient k^ m) for an (i+m)m [m being a positive integer) has a value "V, analyzing 
higher coefficients starting from an (i+m+1) bit and, on finding a bit s where k s =0, generating transformed 
va ues f f t .... t (i+m+1 ;=0 where coefficients k (i+m+1) \o ks are inverted, while adjusting a surplus 
value added when the coefficients between the s bit and the i+m+1 bit were transformed to produce trans- 
formed values f,to t (i+m) from /c,.to k (i ^ 

window dividing means for dividing, after all bits in the positive integer *have been subjected to transfor- 
mation by the addition-substitution transformation means to produce a transformed numerical string the 
transformed numerical string into m-bit windows; 

a provisional calculation table storing multiples of s (where 8=3,5, ... (2m-?)) and the arbitrary point P and 
mult.ply.ng means for searching the provisional calculation table using a binary number in a window to 
obtain a value sp, for adding the value sp to a provisional total S a . and for multiplying the provisional total 
S av by an appropriate power of two before adding a next value sp, 

wherein the multiple kp of the arbitrary point P is found as the provisional total S a when every window has 
been processed by the multiplying means. 

18. The elliptic curve calculation apparatus of Claim 17, wherein m=4. 
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